@kodycodes/cli 1.26.2 → 1.27.0

package/dist/chunk-5JIRHJQP.js

@@ -0,0 +1,1016 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  describeNetworkError
+} from "./chunk-4GIFJVGT.js";
+import {
+  createFileBackend,
+  secretServiceKeyringOptions
+} from "./chunk-3H72XY5R.js";
+import {
+  apiTokenEnvVar,
+  cliName,
+  defaultApiUrl,
+  defaultMcpUrl,
+  keyringService
+} from "./chunk-BTL3PJ2H.js";
+
+// src/api-token-store.ts
+import { Entry } from "@napi-rs/keyring";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function accountForApiUrl(apiUrl) {
+  return `cli-api-token:${new URL(apiUrl).origin}`;
+}
+function apiTokenFileStorePath(apiUrl, home = homedir()) {
+  const origin = new URL(apiUrl).host.replace(/[^a-zA-Z0-9.-]/g, "_");
+  const base = process.platform === "win32" ? join(process.env.APPDATA || join(home, "AppData", "Roaming"), "kody") : process.platform === "darwin" ? join(home, "Library", "Application Support", "kody") : join(process.env.XDG_CONFIG_HOME || join(home, ".config"), "kody");
+  return join(base, `api-token-${origin}.json`);
+}
+function createApiTokenKeyringBackend(apiUrl) {
+  const entry = new Entry(
+    keyringService,
+    accountForApiUrl(apiUrl),
+    secretServiceKeyringOptions
+  );
+  return {
+    kind: "keyring",
+    get() {
+      try {
+        return entry.getPassword();
+      } catch {
+        return null;
+      }
+    },
+    set(value) {
+      entry.setPassword(value);
+    },
+    delete() {
+      try {
+        return entry.deleteCredential();
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function fileBackendFor(apiUrl, resolution) {
+  const path = resolution?.fileStorePath?.(apiUrl) ?? apiTokenFileStorePath(apiUrl);
+  return createFileBackend(path);
+}
+function resolveApiTokenBackend(apiUrl, preferred, resolution) {
+  if (preferred) return preferred;
+  try {
+    return (resolution?.createKeyring ?? createApiTokenKeyringBackend)(apiUrl);
+  } catch {
+    return fileBackendFor(apiUrl, resolution);
+  }
+}
+function parseStoredApiToken(raw) {
+  const parsed = JSON.parse(raw);
+  if (parsed.version !== 1 || typeof parsed.token !== "string" || !parsed.token.startsWith("kody_at_") || typeof parsed.apiUrl !== "string" || typeof parsed.tokenId !== "string") {
+    throw new Error(
+      "Stored Kody API token is invalid. Run `kody auth bootstrap --code \u2026` again."
+    );
+  }
+  return parsed;
+}
+function readParsed(store) {
+  const raw = store.get();
+  if (!raw) return null;
+  return parseStoredApiToken(raw);
+}
+function loadStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+  const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+  try {
+    const loaded = readParsed(store);
+    if (loaded) return loaded;
+  } catch (error) {
+    if (!(store.kind === "keyring" && !backend)) throw error;
+  }
+  if (store.kind === "keyring" && !backend) {
+    return readParsed(fileBackendFor(apiUrl, resolution));
+  }
+  return null;
+}
+function saveStoredApiToken(credentials, backend, resolution) {
+  const store = resolveApiTokenBackend(credentials.apiUrl, backend, resolution);
+  try {
+    store.set(JSON.stringify(credentials));
+    return { backend: store };
+  } catch (error) {
+    if (store.kind === "keyring" && !backend) {
+      const fallback = fileBackendFor(credentials.apiUrl, resolution);
+      fallback.set(JSON.stringify(credentials));
+      return { backend: fallback };
+    }
+    throw error;
+  }
+}
+function deleteStoredApiToken(apiUrl = defaultApiUrl, backend, resolution) {
+  const store = resolveApiTokenBackend(apiUrl, backend, resolution);
+  let deleted = false;
+  try {
+    deleted = store.delete();
+  } catch {
+    deleted = false;
+  }
+  if (store.kind === "keyring" && !backend) {
+    const file = fileBackendFor(apiUrl, resolution);
+    deleted = file.delete() || deleted;
+  }
+  return { deleted, backend: store };
+}
+
+// src/api-token.ts
+var shortAbsoluteLifetimeMs = 24 * 60 * 60 * 1e3;
+var localExecuteOauthPlatformIssueUrl = "https://github.com/kentcdodds/kody/issues/2812";
+var loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function tryParseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function isWorkersDevHostname(hostname) {
+  return hostname.endsWith(".workers.dev");
+}
+function isPairedApiUrl(apiUrl = defaultApiUrl, mcpUrl = defaultMcpUrl) {
+  const api = tryParseUrl(apiUrl);
+  const mcp = tryParseUrl(mcpUrl);
+  if (!api || !mcp) return false;
+  const apiIsLoopback = loopbackHosts.has(api.hostname.toLowerCase());
+  const mcpIsLoopback = loopbackHosts.has(mcp.hostname.toLowerCase());
+  if (apiIsLoopback && mcpIsLoopback) {
+    return ["http:", "https:"].includes(api.protocol) && ["http:", "https:"].includes(mcp.protocol);
+  }
+  if (api.protocol !== "https:" || mcp.protocol !== "https:") return false;
+  const apiIsWorkersDev = isWorkersDevHostname(api.hostname);
+  const mcpIsWorkersDev = isWorkersDevHostname(mcp.hostname);
+  if (apiIsWorkersDev || mcpIsWorkersDev) {
+    if (!apiIsWorkersDev || !mcpIsWorkersDev) return false;
+    const apiLabels = api.hostname.toLowerCase().split(".");
+    const mcpLabels = mcp.hostname.toLowerCase().split(".");
+    return apiLabels.length === mcpLabels.length && apiLabels.slice(1).join(".") === mcpLabels.slice(1).join(".") && apiLabels[0] === `${mcpLabels[0]}-api`;
+  }
+  return api.hostname.toLowerCase() === `api.${mcp.hostname.toLowerCase()}`;
+}
+function expectedPairedApiOrigin(mcpUrl) {
+  const mcp = tryParseUrl(mcpUrl);
+  if (!mcp) return "a paired API origin";
+  if (loopbackHosts.has(mcp.hostname.toLowerCase())) {
+    return "a loopback API origin";
+  }
+  const hostname = mcp.hostname.toLowerCase();
+  if (isWorkersDevHostname(hostname)) {
+    const labels = hostname.split(".");
+    labels[0] = `${labels[0]}-api`;
+    return `https://${labels.join(".")}`;
+  }
+  return `https://api.${hostname}`;
+}
+function readApiToken(values = {}, env = process.env) {
+  const token = (values.token ?? env[apiTokenEnvVar] ?? "").trim();
+  return token.length > 0 ? token : null;
+}
+function resolveScopedApiToken(input = {}) {
+  const token = readApiToken(input.tokenValues, input.env);
+  if (token) return token;
+  const apiUrl = input.apiUrl || defaultApiUrl;
+  const loadApi = input.loadApiToken ?? loadStoredApiToken;
+  return loadApi(apiUrl, input.apiTokenBackend, input.apiTokenResolution)?.token ?? null;
+}
+function isScopedApiToken(token) {
+  return token.startsWith("kody_at_");
+}
+function apiTokenMintInstructions() {
+  return `For CI/headless only: mint with the Kody MCP \`api\` tool \`tokenCreate\` (include \`org:execute\` plus the capability scopes this command needs, e.g. \`package:execute\` / \`integration:read\`) and pass --token or set ${apiTokenEnvVar}.`;
+}
+function capabilityProxyForbiddenMessage(input) {
+  const reason = input.serverMessage ? `: ${input.serverMessage}` : "";
+  return `The API token is not allowed to use CapabilityProxy (${input.code ?? "forbidden"})${reason}.
+Fix: run \`npx @kodycodes/cli login\` (agents on Kody MCP: ${cliBootstrapInstructions()}; CI: tokenCreate with \`org:execute\`, passed via --token or ${apiTokenEnvVar}).`;
+}
+function cliBootstrapInstructions(lifetime = "short") {
+  return `From MCP, call \`cliCredentialBootstrap\` (MCP \`api\` / \`kody.cliCredentialBootstrap\`), then run \`npx @kodycodes/cli auth bootstrap --code <kody_bc_\u2026> --lifetime ${lifetime}\``;
+}
+function inferCliTokenLifetimeAlias(stored, nowMs = Date.now()) {
+  if (!stored) return "short";
+  const absoluteMs = Date.parse(stored.maxExpiresAt ?? "") || Date.parse(stored.expiresAt ?? "");
+  if (!Number.isFinite(absoluteMs)) return "short";
+  return absoluteMs - nowMs > shortAbsoluteLifetimeMs ? "long" : "short";
+}
+function cliBootstrapLifetimeFlags(lifetime = "short") {
+  return `--lifetime ${lifetime}`;
+}
+function cliBootstrapLifetimeMintFields(lifetime = "short") {
+  return { lifetime };
+}
+function currentStoredTokenLifetimeAlias(apiUrl = defaultApiUrl, nowMs = Date.now(), loadApiToken = loadStoredApiToken) {
+  return inferCliTokenLifetimeAlias(loadApiToken(apiUrl), nowMs);
+}
+function missingApiTokenMessage(purpose) {
+  return `${purpose} needs a scoped Kody API token. ${cliBootstrapInstructions()}, or ${apiTokenMintInstructions()}`;
+}
+function missingLocalExecuteAuthMessage(purpose = "execute --local") {
+  return `${purpose} needs auth. ${cliBootstrapInstructions()}; or run \`kody login\`; or for CI/headless, ${apiTokenMintInstructions()}`;
+}
+function missingCliAuthMessage() {
+  return `Not logged in, and no API token is set. ${cliBootstrapInstructions()}; or run \`kody login\` for browser OAuth (search, whoami, cloud execute, and login-backed \`execute --local\`); or for CI/headless, ${apiTokenMintInstructions()}`;
+}
+function rejectedOauthBearerMessage() {
+  return `Kody rejected the bearer from \`kody login\`: the Open API still accepts only scoped \`kody_at_\u2026\` API tokens on CapabilityProxy / package-graph (not MCP OAuth). See ${localExecuteOauthPlatformIssueUrl}. Until that lands, ${apiTokenMintInstructions()}`;
+}
+function readInsufficientScopeDetails(body) {
+  const details = isRecord(body) && isRecord(body.error) && isRecord(body.error.details) ? body.error.details : null;
+  if (!details) return { requiredScope: null, mintScopes: null, denial: null };
+  const requiredScope = readNonEmptyString(details.required_scope) ?? readNonEmptyString(details.required_permission) ?? readStringList(details.required_scopes)?.join(", ") ?? null;
+  return {
+    requiredScope,
+    mintScopes: readStringList(details.mint_scopes),
+    denial: readNonEmptyString(details.denial)
+  };
+}
+function cliBootstrapScopesCommand(scopes, lifetimeFlags = "short") {
+  const flags = lifetimeFlags === "short" || lifetimeFlags === "long" ? cliBootstrapLifetimeFlags(lifetimeFlags) : lifetimeFlags;
+  return `npx @kodycodes/cli auth bootstrap ${flags} --scopes ${scopes.join(",")}`;
+}
+function cliBootstrapMintCall(scopes, lifetime = "short") {
+  const fieldsRecord = lifetime === "short" || lifetime === "long" ? cliBootstrapLifetimeMintFields(lifetime) : lifetime;
+  const fields = [
+    ...Object.entries(fieldsRecord).map(
+      ([key, value]) => `${key}: ${JSON.stringify(value)}`
+    ),
+    `scopes: [${scopes.map((scope) => JSON.stringify(scope)).join(", ")}]`
+  ];
+  return `cliCredentialBootstrap({ ${fields.join(", ")} })`;
+}
+function insufficientScopeMessage(input) {
+  const required = input.requiredScope ?? null;
+  const lifetime = input.currentLifetime === "long" || input.currentLifetime === "short" ? input.currentLifetime : "short";
+  const lifetimeFlags = cliBootstrapLifetimeFlags(lifetime);
+  const lifetimeMint = cliBootstrapLifetimeMintFields(lifetime);
+  if (input.denial === "missing_permission") {
+    return `Kody returned insufficient_scope: your org role does not grant ${required ? `"${required}"` : "the required permission"}. A new token cannot add it; an org Owner can grant it.`;
+  }
+  if (!required) {
+    return `Kody returned insufficient_scope. Mint a token that includes the missing scope: run \`${cliBootstrapScopesCommand(["<scope>", "\u2026"], lifetimeFlags)}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(["<scope>", "\u2026"], lifetimeMint)}\` and run its cli_command. Scopes replace the defaults, so list every scope you need. For CI/headless, mint with tokenCreate and pass --token or set ${apiTokenEnvVar}.`;
+  }
+  const mintScopes = input.mintScopes && input.mintScopes.length > 0 ? input.mintScopes : input.currentScopes && input.currentScopes.length > 0 ? [
+    .../* @__PURE__ */ new Set([...input.currentScopes, ...required.split(/,\s*/)])
+  ].sort() : null;
+  if (!mintScopes) {
+    return `Kody returned insufficient_scope: this token is missing "${required}". Mint a token whose scopes include "${required}" plus the ones you already use (scopes replace the defaults): run \`${cliBootstrapScopesCommand(["<current scopes>", required], lifetimeFlags)}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(["<current scopes>", required], lifetimeMint)}\` and run its cli_command. For CI/headless, mint with tokenCreate including "${required}" and pass --token or set ${apiTokenEnvVar}.`;
+  }
+  return `Kody returned insufficient_scope: this token is missing "${required}". Mint one that includes it: run \`${cliBootstrapScopesCommand(mintScopes, lifetimeFlags)}\` after \`kody login\`, or from Kody MCP call \`${cliBootstrapMintCall(mintScopes, lifetimeMint)}\` and run its cli_command. For CI/headless, mint with tokenCreate using those scopes and pass --token or set ${apiTokenEnvVar}.`;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readNonEmptyString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function readStringList(value) {
+  if (!Array.isArray(value)) return null;
+  const list = value.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean);
+  return list.length > 0 ? list : null;
+}
+function featureDisabledMessage() {
+  return "Kody returned feature_disabled: CapabilityProxy is not enabled for this Kody account (feature flag `local-execute`). `execute --local` and token-auth cloud execute both stop here; minting another token does not bypass the flag. Browser `kody login` can still run cloud execute over MCP.";
+}
+function requireApiToken(values = {}, env = process.env, purpose = "this command", options = {}) {
+  const token = resolveScopedApiToken({
+    tokenValues: values,
+    env,
+    ...options
+  });
+  if (!token) throw new Error(missingApiTokenMessage(purpose));
+  return token;
+}
+function hasExplicitTokenFlag(values) {
+  return typeof values.token === "string" && values.token.trim().length > 0;
+}
+
+// src/credential-call-map.ts
+var credentialCallMapFeature = "credential-call-map";
+var credentialCallMapLimits = {
+  maxKeys: 32,
+  maxPicksPerKey: 16,
+  maxTextLength: 100
+};
+var keyPattern = new RegExp(
+  `^[A-Za-z0-9][A-Za-z0-9._-]{0,${credentialCallMapLimits.maxTextLength - 1}}$`
+);
+function parseCredentialFlag(raw) {
+  const eq = raw.indexOf("=");
+  if (eq <= 0) {
+    throw new Error(
+      `Invalid --credential ${JSON.stringify(raw)}. Use --credential key=name, --credential key=org:name, or --credential key= for none.`
+    );
+  }
+  const key = raw.slice(0, eq);
+  const value = raw.slice(eq + 1);
+  assertCredentialMapKey(key);
+  if (value === "") return { key, picks: [], empty: true };
+  return { key, picks: [parseCredentialPick(value)], empty: false };
+}
+function parseCredentialFlags(flags) {
+  if (!flags || flags.length === 0) return void 0;
+  const collected = /* @__PURE__ */ new Map();
+  const emptyKeys = /* @__PURE__ */ new Set();
+  for (const flag of flags) {
+    const { key, picks, empty } = parseCredentialFlag(flag);
+    if (empty) {
+      if ((collected.get(key)?.length ?? 0) > 0) {
+        throw new Error(
+          `Invalid --credential for ${key}: cannot combine an empty pick (none) with a named pick.`
+        );
+      }
+      emptyKeys.add(key);
+      collected.set(key, []);
+      continue;
+    }
+    if (emptyKeys.has(key)) {
+      throw new Error(
+        `Invalid --credential for ${key}: cannot combine an empty pick (none) with a named pick.`
+      );
+    }
+    const existing = collected.get(key) ?? [];
+    existing.push(...picks);
+    if (existing.length > credentialCallMapLimits.maxPicksPerKey) {
+      throw new Error(
+        `A credentials map takes at most ${credentialCallMapLimits.maxPicksPerKey} picks per key (${key}).`
+      );
+    }
+    collected.set(key, existing);
+  }
+  if (collected.size > credentialCallMapLimits.maxKeys) {
+    throw new Error(
+      `A credentials map takes at most ${credentialCallMapLimits.maxKeys} keys.`
+    );
+  }
+  const map = {};
+  for (const [key, picks] of collected) {
+    if (emptyKeys.has(key)) {
+      map[key] = [];
+      continue;
+    }
+    map[key] = picks.length === 1 ? picks[0] : picks;
+  }
+  return map;
+}
+function parseCredentialPick(value) {
+  const trimmed = value.trim();
+  const colon = trimmed.indexOf(":");
+  if (colon > 0) {
+    const prefix = trimmed.slice(0, colon);
+    if (prefix === "org" || prefix === "personal") {
+      const name = trimmed.slice(colon + 1).trim();
+      assertCredentialText(name, "credential name");
+      return { name, scope: prefix };
+    }
+  }
+  assertCredentialText(trimmed, "credential name");
+  return trimmed;
+}
+function assertCredentialMapKey(key) {
+  if (!keyPattern.test(key)) {
+    throw new Error(
+      `Invalid --credential key ${JSON.stringify(key)}. A key starts with a letter or digit and uses letters, digits, dots, underscores, or hyphens (max ${credentialCallMapLimits.maxTextLength}).`
+    );
+  }
+}
+function assertCredentialText(value, label) {
+  if (!value || value.length > credentialCallMapLimits.maxTextLength) {
+    throw new Error(
+      `Invalid --credential ${label} ${JSON.stringify(value)}. Use 1\u2013${credentialCallMapLimits.maxTextLength} characters.`
+    );
+  }
+}
+function sessionSupportsCredentialCallMap(features) {
+  return Array.isArray(features) && features.includes(credentialCallMapFeature);
+}
+function missingCredentialCallMapFeatureMessage() {
+  return "This Kody host does not support --credential yet.";
+}
+function formatCredentialFlagSuggestion(key, pick) {
+  if (typeof pick === "string") {
+    return `--credential ${key}=${pick}`;
+  }
+  if (Array.isArray(pick)) {
+    if (pick.length === 0) return `--credential ${key}=`;
+    return pick.map((entry) => formatCredentialFlagSuggestion(key, entry)).filter((line) => line !== null).join("\n");
+  }
+  if (pick && typeof pick === "object") {
+    const record = pick;
+    if (typeof record.name !== "string" || !record.name) return null;
+    if (record.scope === "org" || record.scope === "personal") {
+      return `--credential ${key}=${record.scope}:${record.name}`;
+    }
+    return `--credential ${key}=${record.name}`;
+  }
+  return null;
+}
+function formatCredentialClientError(error) {
+  const code = typeof error.code === "string" && error.code ? error.code : "credential_error";
+  const message = typeof error.message === "string" && error.message ? error.message : "The credential could not be used.";
+  const lines = [`${code}: ${message}`];
+  const retries = Array.isArray(error.retryWith) ? error.retryWith : [];
+  for (const entry of retries) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const credentials = entry.credentials;
+    if (!credentials || typeof credentials !== "object" || Array.isArray(credentials)) {
+      continue;
+    }
+    for (const [key, pick] of Object.entries(
+      credentials
+    )) {
+      const suggestion = formatCredentialFlagSuggestion(key, pick);
+      if (suggestion) {
+        for (const line of suggestion.split("\n")) {
+          lines.push(`  retry: ${line}`);
+        }
+      }
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/package-info.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+function readPackageVersion() {
+  try {
+    const pkg = require2("../package.json");
+    return typeof pkg.version === "string" && pkg.version.trim() ? pkg.version.trim() : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+// src/capability-proxy.ts
+import { Readable } from "node:stream";
+var capabilityProxySessionPath = "v1/capability-proxy/session";
+var capabilityProxyCallPath = "v1/capability-proxy/call";
+var capabilityProxyGatewayFetchPath = "v1/capability-proxy/gateway-fetch";
+var gatewayFetchUrlHeaderName = "X-Kody-Gateway-Url";
+var gatewayFetchMethodHeaderName = "X-Kody-Gateway-Method";
+var gatewayFetchPackageIdHeaderName = "X-Kody-Gateway-Package-Id";
+var gatewayFetchHeadersHeaderName = "X-Kody-Gateway-Headers";
+var secretResolutionHeaderName = "x-kody-secret-resolution";
+var capabilityProxyGatewayDeadlineMs = 5 * 6e4;
+var capabilityProxyHttpTimeoutMs = 7 * 6e4;
+var capabilityProxyConnectTimeoutMs = 1e4;
+function nodeUsesEnvProxy(env = process.env, execArgv = process.execArgv) {
+  if (env.NODE_USE_ENV_PROXY === "1") return true;
+  const flags = [...execArgv, ...(env.NODE_OPTIONS ?? "").split(/\s+/)];
+  return flags.includes("--use-env-proxy");
+}
+var envProxyAgentMinimumNode = { 22: 21, 24: 5 };
+function nodeAgentHonorsEnvProxy(version = process.versions.node) {
+  const [major = 0, minor = 0] = version.split(".").map(Number);
+  const minimumMinor = envProxyAgentMinimumNode[major];
+  if (minimumMinor === void 0) return major > 24;
+  return minor >= minimumMinor;
+}
+function createCapabilityProxyFetch(options = {}) {
+  const timeoutMs = options.timeoutMs ?? capabilityProxyHttpTimeoutMs;
+  const connectTimeoutMs = options.connectTimeoutMs ?? capabilityProxyConnectTimeoutMs;
+  const useEnvProxy = options.useEnvProxy ?? nodeUsesEnvProxy();
+  if (useEnvProxy && !nodeAgentHonorsEnvProxy()) {
+    throw new Error(
+      `Node ${process.version} cannot route CapabilityProxy requests through HTTP_PROXY / HTTPS_PROXY: env-proxy support needs Node 22.21 or 24.5 and later. Upgrade Node or unset NODE_USE_ENV_PROXY / --use-env-proxy.`
+    );
+  }
+  let transports = null;
+  return async (input, init = {}) => {
+    const url = input instanceof URL ? input : new URL(input instanceof Request ? input.url : input);
+    transports ??= loadTransports(useEnvProxy);
+    const transport = (await transports)[url.protocol];
+    if (!transport) {
+      throw new TypeError(
+        `Unsupported protocol for the Kody API: ${url.protocol}`
+      );
+    }
+    const body = init.body;
+    if (body !== void 0 && body !== null && typeof body !== "string") {
+      throw new TypeError("CapabilityProxy requests send string bodies.");
+    }
+    return new Promise((resolve, reject) => {
+      const request = transport.request(
+        url,
+        {
+          agent: transport.agent,
+          method: init.method ?? "GET",
+          headers: Object.fromEntries(new Headers(init.headers))
+        },
+        (response) => {
+          clearTimeout(connectTimer);
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("error", reject);
+          response.on(
+            "end",
+            () => resolve(toResponse(response, Buffer.concat(chunks)))
+          );
+        }
+      );
+      const connectTimer = setTimeout(() => {
+        request.destroy(
+          new Error(
+            `Kody API did not connect within ${connectTimeoutMs}ms (${url.pathname}).`
+          )
+        );
+      }, connectTimeoutMs);
+      request.on("socket", (socket) => {
+        const clearConnectTimer = () => clearTimeout(connectTimer);
+        if (url.protocol === "https:") {
+          if (tlsHandshakePending(socket) === false) {
+            clearConnectTimer();
+            return;
+          }
+          socket.once("secureConnect", clearConnectTimer);
+          return;
+        }
+        if (!socket.connecting) {
+          clearConnectTimer();
+          return;
+        }
+        socket.once("connect", clearConnectTimer);
+      });
+      request.setTimeout(
+        timeoutMs,
+        () => request.destroy(
+          new Error(
+            `Kody API sent nothing for ${timeoutMs}ms (${url.pathname}).`
+          )
+        )
+      );
+      request.on("error", (error) => {
+        clearTimeout(connectTimer);
+        reject(error);
+      });
+      const { signal } = init;
+      if (signal) {
+        const abort = () => {
+          clearTimeout(connectTimer);
+          request.destroy(abortError(signal.reason));
+        };
+        if (signal.aborted) {
+          abort();
+        } else {
+          signal.addEventListener("abort", abort, { once: true });
+          request.once(
+            "close",
+            () => signal.removeEventListener("abort", abort)
+          );
+        }
+      }
+      request.end(body ?? void 0);
+    });
+  };
+}
+async function loadTransports(useEnvProxy) {
+  const [http, https] = await Promise.all([
+    import("node:http"),
+    import("node:https")
+  ]);
+  const agentOptions = {
+    keepAlive: true,
+    ...useEnvProxy ? { proxyEnv: process.env } : {}
+  };
+  return {
+    "http:": {
+      agent: unrefFreeSockets(new http.Agent(agentOptions)),
+      request: http.request
+    },
+    "https:": {
+      agent: unrefFreeSockets(new https.Agent(agentOptions)),
+      request: https.request
+    }
+  };
+}
+function unrefFreeSockets(agent) {
+  agent.on("free", (socket) => {
+    socket.unref();
+  });
+  return agent;
+}
+function tlsHandshakePending(socket) {
+  if (!("secureConnecting" in socket)) return null;
+  return socket.secureConnecting;
+}
+function abortError(reason) {
+  if (reason instanceof Error) return reason;
+  return new DOMException(
+    typeof reason === "string" ? reason : "This operation was aborted",
+    "AbortError"
+  );
+}
+function toResponse(response, body) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(response.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (value !== void 0) {
+      headers.set(name, value);
+    }
+  }
+  const status = response.statusCode ?? 0;
+  const bodyless = status === 204 || status === 205 || status === 304;
+  return new Response(bodyless ? null : body, {
+    status,
+    statusText: response.statusMessage ?? "",
+    headers
+  });
+}
+var defaultCapabilityProxyFetch = null;
+function capabilityProxyFetch() {
+  defaultCapabilityProxyFetch ??= createCapabilityProxyFetch();
+  return defaultCapabilityProxyFetch;
+}
+var CapabilityProxyError = class extends Error {
+  status;
+  code;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CapabilityProxyError";
+    this.status = options.status ?? null;
+    this.code = options.code ?? null;
+  }
+};
+var loopbackHosts2 = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function assertTokenSafeApiUrl(apiUrl) {
+  let url;
+  try {
+    url = new URL(apiUrl);
+  } catch {
+    throw new Error(`Invalid Kody API URL: ${apiUrl}`);
+  }
+  if (url.protocol === "https:") return;
+  if (url.protocol === "http:" && loopbackHosts2.has(url.hostname)) return;
+  throw new Error(
+    `Refusing to send the API token to ${url.origin}: use https (plain http is only allowed for localhost).`
+  );
+}
+function capabilityProxyUrl(apiUrl, path) {
+  const base = apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
+  return new URL(path, base);
+}
+function withOrgQuery(url, org) {
+  if (org) url.searchParams.set("org", org);
+  return url;
+}
+async function openCapabilityProxySession(input) {
+  const url = withOrgQuery(
+    capabilityProxyUrl(input.apiUrl, capabilityProxySessionPath),
+    input.org
+  );
+  const response = await send(input, url, { method: "GET" });
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw describeFailure(response.status, body, url, "session", input.token);
+  }
+  const record = isRecord2(body) ? body : {};
+  return {
+    scopes: Array.isArray(record.scopes) ? record.scopes.filter(
+      (scope) => typeof scope === "string"
+    ) : [],
+    expiresAt: typeof record.expiresAt === "string" ? record.expiresAt : null,
+    features: Array.isArray(record.features) ? record.features.filter(
+      (feature) => typeof feature === "string"
+    ) : []
+  };
+}
+async function callCapabilityProxy(input) {
+  const url = withOrgQuery(
+    capabilityProxyUrl(input.apiUrl, capabilityProxyCallPath),
+    input.org
+  );
+  const payload = { path: input.path, args: input.args };
+  if (input.conversationId !== void 0)
+    payload.conversationId = input.conversationId;
+  if (input.credentials !== void 0) payload.credentials = input.credentials;
+  const response = await send(input, url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(payload)
+  });
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw describeFailure(response.status, body, url, "call", input.token);
+  }
+  const failure = readErrorBody(body);
+  if (failure) {
+    throw new CapabilityProxyError(failure.message, {
+      status: response.status,
+      code: failure.code
+    });
+  }
+  return isRecord2(body) ? body.result : void 0;
+}
+async function callCapabilityProxyGatewayFetchStream(input) {
+  assertTokenSafeApiUrl(input.apiUrl);
+  const url = withOrgQuery(
+    capabilityProxyUrl(input.apiUrl, capabilityProxyGatewayFetchPath),
+    input.org
+  );
+  const timeoutMs = capabilityProxyHttpTimeoutMs;
+  const connectTimeoutMs = capabilityProxyConnectTimeoutMs;
+  const useEnvProxy = nodeUsesEnvProxy();
+  if (useEnvProxy && !nodeAgentHonorsEnvProxy()) {
+    throw new Error(
+      `Node ${process.version} cannot route CapabilityProxy requests through HTTP_PROXY / HTTPS_PROXY: env-proxy support needs Node 22.21 or 24.5 and later. Upgrade Node or unset NODE_USE_ENV_PROXY / --use-env-proxy.`
+    );
+  }
+  const transports = await loadTransports(useEnvProxy);
+  const transport = transports[url.protocol];
+  if (!transport) {
+    throw new TypeError(
+      `Unsupported protocol for the Kody API: ${url.protocol}`
+    );
+  }
+  const headers = {
+    accept: "*/*",
+    authorization: `Bearer ${input.token}`,
+    "user-agent": `${cliName}/${readPackageVersion()}`,
+    [gatewayFetchUrlHeaderName]: input.gateway.url
+  };
+  if (input.gateway.method) {
+    headers[gatewayFetchMethodHeaderName] = input.gateway.method;
+  }
+  if (input.gateway.packageId) {
+    headers[gatewayFetchPackageIdHeaderName] = input.gateway.packageId;
+  }
+  if (input.gateway.headers && Object.keys(input.gateway.headers).length > 0) {
+    headers[gatewayFetchHeadersHeaderName] = JSON.stringify(
+      input.gateway.headers
+    );
+  }
+  if (input.gateway.secretResolution) {
+    headers[secretResolutionHeaderName] = input.gateway.secretResolution;
+  }
+  if (input.gateway.contentType) {
+    headers["content-type"] = input.gateway.contentType;
+  }
+  if (input.contentLength) {
+    headers["content-length"] = input.contentLength;
+  }
+  const signal = input.signal;
+  return await new Promise((resolve, reject) => {
+    const request = transport.request(
+      url,
+      {
+        agent: transport.agent,
+        method: "POST",
+        headers
+      },
+      (response) => {
+        clearTimeout(connectTimer);
+        resolve(nodeIncomingToWebResponse(response));
+      }
+    );
+    const connectTimer = setTimeout(() => {
+      request.destroy(
+        new Error(
+          `Kody API did not connect within ${connectTimeoutMs}ms (${url.pathname}).`
+        )
+      );
+    }, connectTimeoutMs);
+    request.on("socket", (socket) => {
+      const clearConnectTimer = () => clearTimeout(connectTimer);
+      if (url.protocol === "https:") {
+        if (tlsHandshakePending(socket) === false) {
+          clearConnectTimer();
+          return;
+        }
+        socket.once("secureConnect", clearConnectTimer);
+        return;
+      }
+      if (!socket.connecting) {
+        clearConnectTimer();
+        return;
+      }
+      socket.once("connect", clearConnectTimer);
+    });
+    request.setTimeout(
+      timeoutMs,
+      () => request.destroy(
+        new Error(
+          `Kody API sent nothing for ${timeoutMs}ms (${url.pathname}).`
+        )
+      )
+    );
+    request.on("error", (error) => {
+      clearTimeout(connectTimer);
+      reject(
+        error instanceof CapabilityProxyError ? error : new CapabilityProxyError(
+          `Could not reach the Kody API at ${url.origin} (${describeNetworkError(error)}). Check --api-url / KODY_API_URL and your network.`
+        )
+      );
+    });
+    if (signal) {
+      const abort = () => {
+        clearTimeout(connectTimer);
+        request.destroy(abortError(signal.reason));
+      };
+      if (signal.aborted) {
+        abort();
+      } else {
+        signal.addEventListener("abort", abort, { once: true });
+        request.once("close", () => signal.removeEventListener("abort", abort));
+      }
+    }
+    if (input.body) {
+      input.body.pipe(request);
+      input.body.on("error", (error) => {
+        clearTimeout(connectTimer);
+        request.destroy(error);
+      });
+    } else {
+      request.end();
+    }
+  });
+}
+function nodeIncomingToWebResponse(response) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(response.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (value !== void 0) {
+      headers.set(name, value);
+    }
+  }
+  const status = response.statusCode ?? 0;
+  const bodyless = status === 101 || status === 103 || status === 204 || status === 205 || status === 304;
+  if (bodyless) {
+    response.resume();
+    return new Response(null, {
+      status,
+      statusText: response.statusMessage ?? "",
+      headers
+    });
+  }
+  return new Response(
+    Readable.toWeb(response),
+    {
+      status,
+      statusText: response.statusMessage ?? "",
+      headers
+    }
+  );
+}
+async function checkCredentialCallMap(input) {
+  const args = {};
+  if (input.strict === true) args.strict = true;
+  if (input.packageId !== void 0) args.packageId = input.packageId;
+  const result = await callCapabilityProxy({
+    apiUrl: input.apiUrl,
+    token: input.token,
+    fetchFn: input.fetchFn,
+    signal: input.signal,
+    path: ["kody", "credentialClientCheck"],
+    args: [args],
+    conversationId: input.conversationId,
+    credentials: input.credentials
+  });
+  if (!isRecord2(result)) {
+    throw new CapabilityProxyError(
+      "credentialClientCheck returned an unexpected result."
+    );
+  }
+  if (result.ok === false) {
+    const error = isRecord2(result.error) ? result.error : {};
+    const code = typeof error.code === "string" ? error.code : "credential_error";
+    throw new CapabilityProxyError(formatCredentialClientError(error), { code });
+  }
+  const value = isRecord2(result.value) ? result.value : null;
+  const warnings = Array.isArray(value?.warnings) ? value.warnings.filter(
+    (warning) => typeof warning === "string"
+  ) : [];
+  return { warnings };
+}
+async function send(input, url, init) {
+  const fetchFn = input.fetchFn ?? capabilityProxyFetch();
+  try {
+    return await fetchFn(url, {
+      ...init,
+      signal: input.signal,
+      headers: {
+        ...init.headers,
+        accept: "application/json",
+        authorization: `Bearer ${input.token}`,
+        "user-agent": `${cliName}/${readPackageVersion()}`
+      }
+    });
+  } catch (error) {
+    const reason = describeNetworkError(error);
+    throw new CapabilityProxyError(
+      `Could not reach the Kody API at ${url.origin} (${reason}). Check --api-url / KODY_API_URL and your network.`
+    );
+  }
+}
+async function readJson(response) {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function readErrorBody(body) {
+  if (!isRecord2(body) || body.error == null) return null;
+  const { error } = body;
+  if (typeof error === "string") return { code: null, message: error };
+  if (isRecord2(error)) {
+    const code = typeof error.code === "string" ? error.code : null;
+    const message = typeof error.message === "string" ? error.message : code ?? JSON.stringify(error);
+    return { code, message };
+  }
+  return { code: null, message: String(error) };
+}
+function describeFailure(status, body, url, stage, token) {
+  const failure = readErrorBody(body);
+  const code = failure?.code ?? null;
+  const detail = failure?.message ? ` Server said: ${failure.message}` : "";
+  if (status === 401) {
+    const message = isScopedApiToken(token) ? `Kody rejected the API token (expired, revoked, or malformed). Mint a fresh scoped token and pass it with --token or ${apiTokenEnvVar}.${detail}` : `${rejectedOauthBearerMessage()}${detail}`;
+    return new CapabilityProxyError(message, { status, code });
+  }
+  if (code === "feature_disabled") {
+    return new CapabilityProxyError(`${featureDisabledMessage()}${detail}`, {
+      status,
+      code
+    });
+  }
+  if (code === "insufficient_scope") {
+    return new CapabilityProxyError(
+      `${insufficientScopeMessage({
+        ...readInsufficientScopeDetails(body),
+        currentLifetime: currentStoredTokenLifetimeAlias(url.origin)
+      })}${detail}`,
+      { status, code }
+    );
+  }
+  if (status === 403 && stage === "session") {
+    return new CapabilityProxyError(
+      capabilityProxyForbiddenMessage({
+        code,
+        serverMessage: failure?.message
+      }),
+      { status, code }
+    );
+  }
+  if (status === 404 && stage === "session") {
+    return new CapabilityProxyError(
+      `CapabilityProxy was not found at ${url.href}. Local execute may not be deployed on this Kody API yet; check --api-url / KODY_API_URL.`,
+      { status, code }
+    );
+  }
+  return new CapabilityProxyError(
+    failure?.message ?? `Kody API request failed with HTTP ${status} (${url.pathname}).`,
+    { status, code }
+  );
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export {
+  loadStoredApiToken,
+  saveStoredApiToken,
+  deleteStoredApiToken,
+  isPairedApiUrl,
+  expectedPairedApiOrigin,
+  readApiToken,
+  resolveScopedApiToken,
+  isScopedApiToken,
+  capabilityProxyForbiddenMessage,
+  currentStoredTokenLifetimeAlias,
+  missingLocalExecuteAuthMessage,
+  missingCliAuthMessage,
+  rejectedOauthBearerMessage,
+  readInsufficientScopeDetails,
+  cliBootstrapMintCall,
+  insufficientScopeMessage,
+  featureDisabledMessage,
+  requireApiToken,
+  hasExplicitTokenFlag,
+  parseCredentialFlags,
+  sessionSupportsCredentialCallMap,
+  missingCredentialCallMapFeatureMessage,
+  readPackageVersion,
+  gatewayFetchUrlHeaderName,
+  gatewayFetchMethodHeaderName,
+  gatewayFetchPackageIdHeaderName,
+  gatewayFetchHeadersHeaderName,
+  secretResolutionHeaderName,
+  assertTokenSafeApiUrl,
+  capabilityProxyUrl,
+  openCapabilityProxySession,
+  callCapabilityProxy,
+  callCapabilityProxyGatewayFetchStream,
+  checkCredentialCallMap
+};
+//# sourceMappingURL=chunk-5JIRHJQP.js.map